Securityaffairs.Co

Malware KONNI Uses AI for PowerShell Backdoors; Badbox 2.0 Botnet Investigated

First seen 2 Feb 2026, 17:45 UTC • Securityaffairs.Co

•30.0

Article Content

Include sub-articles 1 / 1

Browse articles

ThreatCluster

Malware KONNI has adopted artificial intelligence to generate PowerShell backdoors, enhancing its capabilities in cyber attacks. The Badbox 2.0 botnet, believed to be weaponized in China, is reportedly being deployed in targeted espionage campaigns in India. Additionally, a new Android Trojan campaign is utilizing Hugging Face hosting for its RAT payload.

How this analysis works

Attack Flow

8 entities, 8 inferred relationships (STIX 2.1).

Threat Actor (1)

Konni

Technique (2)

Botnet
Trojan

Campaign (1)

SyncFuture Espionage Targeted Campaign

Malware (1)

Badbox 2.0

Affected Platform (1)

Android

Tool (2)

Hugging Face
PowerShell

Relationships

Konni uses Badbox 2.0
Konni uses Hugging Face
Konni uses PowerShell
Konni uses Botnet
Konni uses Trojan
SyncFuture Espionage Targeted Campaign attributed to Konni
SyncFuture Espionage Targeted Campaign uses Badbox 2.0
Konni related to Android

Continue Reading

MuddyWater Targets U.S. Entities Amid Geopolitical Tensions China-aligned APT Groups Target Global Maritime and Tech Sectors Amid Geopolitical Tensions North Korean Konni Group Uses KakaoTalk for Malware Distribution in Spear-Phishing Campaign Cyber Adversaries Exploit File Enumeration and Data Collection Techniques North Korean Hackers Launch Destructive Cyberattack on Smartphones and PCs Microsoft Mitigates Windows LNK Vulnerability Exploited in Zero-Day Attacks

Malware KONNI Uses AI for PowerShell Backdoors; Badbox 2.0 Botnet Investigated

Article Content

More articles in this cluster

Attack Flow

Defensive Countermeasures

Extracted Entities

Continue Reading